As Japan confronts what its own defense establishment calls the most severe security environment since the Second World War, the country must now decide not merely whether to entrust its most sensitive military data to cloud systems, but how to do so without surrendering the sovereignty that gives such data its meaning. The question is ancient in its essence — how does a nation remain open enough to act with allies yet closed enough to protect its secrets — dressed now in the language of encryption keys, tiered providers, and air-gapped networks. Australia has charted one path; Ukraine, forged
Japan's cloud sovereignty challenge: lessons from Australia's defense data strategy
The decision about cloud architecture matters as much as the migration itself.
Mark
Why can't Japan just build its own cloud system and keep everything domestic?
Mimi
Because the most advanced technology is concentrated in the U.S. and China. Japan could build something, but it would lag behind what AWS or Google can offer. The real question is not ownership—it's control. You need legal agreements and technical safeguards that prevent unwanted access, even if the servers are in another country.
Mark
What's the difference between Australia's approach and Ukraine's?
Mimi
Australia isolates its classified data completely—it's on networks cut off from the internet. Ukraine does the opposite. During wartime, they moved sensitive data to cloud systems in allied countries across Europe. If the servers get attacked, the data is already somewhere else. It's about resilience versus isolation.
Mark
Which approach makes more sense for Japan?
Mimi
That depends on what threat you're preparing for. If you're worried about cyber theft, isolation works. If you're worried about your country being attacked and needing to keep operating, dispersed storage might be better. Japan faces both risks, which is why the choice is so hard.
Mark
What's the CLOUD Act, and why does it matter?
Mimi
It's a U.S. law that lets the American government demand data from U.S. tech companies, even if that data is stored overseas. Australia negotiated a bilateral agreement to prevent the U.S. from using it to extract Australian secrets. Japan will need to do something similar.
Mark
So Japan should just copy Australia's model?
Mimi
Australia's model is a good starting point—the tiered approach with different providers for different security levels, the certification requirements, the legal agreements. But Japan also needs to think about whether isolation is the right answer if it faces a regional conflict. Australia isn't in the same threat environment.
The Pulse
- Japan's classified military data is already migrating to cloud systems, but the legal and technical frameworks to protect it from foreign governments — including friendly ones — remain unfinished.
- Foreign firms control 70 percent of Japan's cloud market, leaving the country structurally dependent on American hyperscalers whose data obligations to Washington are governed by U.S. law, not Japanese sovereignty.
- Australia's tiered model — pairing AWS for top-secret workloads with domestic providers and a bilateral agreement neutralizing the CLOUD Act — offers Japan a tested blueprint for trustworthy partnership without the illusion of total independence.
- Ukraine's wartime decision to disperse sensitive data across allied European infrastructure rather than isolate it at home raises a harder question: in a live conflict, is geographic separation a shield or a liability?
- Japan is racing to establish unified cloud classification standards before the fiscal year closes, but the deeper choice — air-gapped isolation versus dispersed allied storage — will define whether its military can function under sustained attack.
As Japan confronts what its own defense establishment calls the most severe security environment since the Second World War, the country must now decide not merely whether to entrust its most sensitive military data to cloud systems, but how to do so without surrendering the sovereignty that gives such data its meaning. The question is ancient in its essence — how does a nation remain open enough to act with allies yet closed enough to protect its secrets — dressed now in the language of encryption keys, tiered providers, and air-gapped networks. Australia has charted one path; Ukraine, forged in active conflict, has charted another; and Japan, watching both, must choose an architecture that will outlast the moment of its choosing.
Japan's defense establishment is navigating a decision that will shape how the country protects its most sensitive military information for decades. The transition to cloud computing is already underway — the real question is whether the architecture chosen will hold under pressure.
The case for cloud is not ideological but operational. Processing power scales instantly when satellites and drones are flooding systems with data. Cybersecurity tools can respond to threats in minutes rather than days. And the cost savings — typically 20 to 40 percent of defense IT spending — are difficult for any government to ignore. The United States recognized this in 2022 when it awarded cloud contracts to AWS, Google, Microsoft, and Oracle. Australia built on the same logic, pairing those American hyperscalers with domestic providers like Vault Cloud and Macquarie Government.
Japan's position is more exposed. Foreign companies hold roughly 70 percent of its cloud market, and while Sakura Internet was formally selected as a domestic partner in March 2026, the imbalance remains stark. The honest framing is not whether Japan can achieve absolute cloud sovereignty — it cannot — but whether it can construct partnerships with enough legal and technical safeguard to keep hostile actors out.
Australia's model offers the clearest template. It uses a tiered structure: AWS for top-secret data, Vault Cloud for classified workloads, and other providers for lower sensitivity levels. Every vendor undergoes rigorous certification. Crucially, Australia negotiated a bilateral agreement with Washington to prevent the CLOUD Act — which compels American firms to surrender data to U.S. authorities regardless of where it is stored — from being used to extract Australian secrets. Encryption keys remain in Australian hands. The systems are isolated from the public internet entirely.
Japan is moving toward unified classification standards and studying how to store classified information securely, but one defining choice remains: air-gapped isolation or dispersed cross-border storage. Australia chose isolation. Ukraine, under active Russian attack, chose the opposite — moving sensitive workloads to allied European infrastructure and relying on encryption and dispersed storage to enable real-time battlefield coordination. The Ukrainian model trades geographic containment for operational resilience.
Japan's 2026 Defense white paper describes the current security environment as the most severe and complex since the end of World War II. A regional conflict involving Japanese territory is no longer a theoretical scenario. In that context, the architecture of cloud infrastructure — not merely the decision to migrate — may determine whether the military can function when it matters most.
Japan's defense establishment faces a decision that will shape how the country protects its most sensitive military information for decades to come. The question is not whether to move classified data to cloud systems—that transition is already underway—but how to do it in a way that keeps hostile actors out while preserving the ability to share information with allies in real time.
Cloud computing offers three concrete advantages that make the shift inevitable for any modern military. Processing power scales instantly, which matters when satellites and drones are generating torrents of data during active operations. Cybersecurity tools can detect threats and patch vulnerabilities in minutes rather than days, a critical edge as artificial intelligence accelerates the pace of attacks. And the cost savings are substantial: moving to cloud infrastructure typically cuts defense IT spending by 20 to 40 percent, a meaningful relief for a budget-conscious government. The U.S. Department of Defense recognized these benefits in 2022 when it awarded cloud contracts to Amazon Web Services, Google, Microsoft, and Oracle. Australia followed suit, building partnerships with those same American hyperscalers alongside domestic providers like Vault Cloud and Macquarie Government.
Japan's situation is more constrained. Foreign companies control roughly 70 percent of Japan's cloud market. In March 2026, the government formally selected Sakura Internet as a domestic cloud provider to work alongside American firms, but the foreign dominance remains stark. This imbalance reflects a broader reality: cutting-edge technology is concentrated in the United States and China, so most countries cannot build their defense infrastructure entirely at home. The real challenge is not achieving absolute sovereignty—that is a fantasy—but rather establishing trustworthy partnerships with legal and technical safeguards that prevent unwanted access to classified data.
Australia has built a model worth studying. The country uses a tiered approach: AWS hosts top-secret information, domestic provider Vault Cloud handles secret and top-secret workloads, and Google, Oracle, and Macquarie Government manage lower classification levels. Every provider undergoes rigorous security evaluation through the Information Security Registered Assessors Program and must meet the Hosting Certification Framework. The legal architecture is equally important. Australia negotiated a bilateral agreement with the United States to prevent the CLOUD Act—a U.S. law that compels American tech firms to hand over data to the government, regardless of where it is stored—from being used to extract Australian secrets. Technical controls include encryption with keys held by the Australian government, strict limits on who can access the systems, and complete isolation from the public internet and the hyperscalers' global networks.
Japan is moving in this direction. The government is working toward unified cloud classification standards by the end of the fiscal year and is studying how to store classified information securely. One critical decision looms: whether to adopt an air-gapped system, in which classified data lives on networks completely disconnected from the internet, or to follow a different path. Australia chose air-gapping, combining isolated cloud storage with tools to move classified information in and out securely. Ukraine, facing Russian cyber and kinetic attacks, took a radically different approach. Rather than isolating data inside the country, Ukraine moved sensitive workloads to commercial cloud infrastructure in allied European nations, relying on encryption, dispersed storage, and high-speed connections to enable real-time battlefield analysis and coordination. The Ukrainian model prioritizes operational resilience and data availability over geographic isolation.
Japan's strategic environment makes this choice urgent. The government's 2026 Defense white paper describes the nation's security situation as the most severe and complex since the end of World War II. A regional conflict involving Japanese territory is no longer theoretical. If such a scenario unfolds, the architecture of Japan's cloud infrastructure—whether data is locked in isolated networks or dispersed across allied systems—could determine whether the military can operate effectively under sustained attack. The decision about which cloud solution to adopt matters as much as the decision to migrate to cloud at all.
Notable Quotes
If Ukraine today may be East Asia tomorrow, then air-gapped systems and localized data may not be the optimal solution.— Lowy Institute analysis
Japan faces the most severe and complex security environment since the end of World War II, with a regional contingency not out of the question.— Japan's 2026 Defence of Japan white paper
Want the full story?
Read the original at Lowy Institute ↗
War & Conflict